interception_agent.cc 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207
  1. // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // For information about interceptions as a whole see
  5. // http://dev.chromium.org/developers/design-documents/sandbox .
  6. #include "sandbox/win/src/interception_agent.h"
  7. #include <windows.h>
  8. #include <stddef.h>
  9. #include "sandbox/win/src/eat_resolver.h"
  10. #include "sandbox/win/src/interception_internal.h"
  11. #include "sandbox/win/src/interceptors.h"
  12. #include "sandbox/win/src/sandbox_nt_util.h"
  13. namespace {
  14. // Returns true if target lies between base and base + range.
  15. bool IsWithinRange(const void* base, size_t range, const void* target) {
  16. const char* end = reinterpret_cast<const char*>(base) + range;
  17. return reinterpret_cast<const char*>(target) < end;
  18. }
  19. } // namespace
  20. namespace sandbox {
  21. // The list of intercepted functions back-pointers.
  22. SANDBOX_INTERCEPT OriginalFunctions g_originals;
  23. // Memory buffer mapped from the parent, with the list of interceptions.
  24. SANDBOX_INTERCEPT SharedMemory* g_interceptions = nullptr;
  25. InterceptionAgent* InterceptionAgent::GetInterceptionAgent() {
  26. static InterceptionAgent* s_singleton = nullptr;
  27. if (!s_singleton) {
  28. if (!g_interceptions)
  29. return nullptr;
  30. size_t array_bytes = g_interceptions->num_intercepted_dlls * sizeof(void*);
  31. s_singleton = reinterpret_cast<InterceptionAgent*>(
  32. new (NT_ALLOC) char[array_bytes + sizeof(InterceptionAgent)]);
  33. bool success = s_singleton->Init(g_interceptions);
  34. if (!success) {
  35. operator delete(s_singleton, NT_ALLOC);
  36. s_singleton = nullptr;
  37. }
  38. }
  39. return s_singleton;
  40. }
  41. bool InterceptionAgent::Init(SharedMemory* shared_memory) {
  42. interceptions_ = shared_memory;
  43. for (int i = 0; i < shared_memory->num_intercepted_dlls; i++)
  44. dlls_[i] = nullptr;
  45. return true;
  46. }
  47. bool InterceptionAgent::DllMatch(const UNICODE_STRING* full_path,
  48. const UNICODE_STRING* name,
  49. const DllPatchInfo* dll_info) {
  50. UNICODE_STRING current_name;
  51. current_name.Length = static_cast<USHORT>(
  52. GetNtExports()->wcslen(dll_info->dll_name) * sizeof(wchar_t));
  53. current_name.MaximumLength = current_name.Length;
  54. current_name.Buffer = const_cast<wchar_t*>(dll_info->dll_name);
  55. BOOLEAN case_insensitive = TRUE;
  56. if (full_path && !GetNtExports()->RtlCompareUnicodeString(
  57. &current_name, full_path, case_insensitive)) {
  58. return true;
  59. }
  60. return name && !GetNtExports()->RtlCompareUnicodeString(&current_name, name,
  61. case_insensitive);
  62. }
  63. bool InterceptionAgent::OnDllLoad(const UNICODE_STRING* full_path,
  64. const UNICODE_STRING* name,
  65. void* base_address) {
  66. DllPatchInfo* dll_info = interceptions_->dll_list;
  67. int i = 0;
  68. for (; i < interceptions_->num_intercepted_dlls; i++) {
  69. if (DllMatch(full_path, name, dll_info))
  70. break;
  71. dll_info = reinterpret_cast<DllPatchInfo*>(
  72. reinterpret_cast<char*>(dll_info) + dll_info->record_bytes);
  73. }
  74. // Return now if the dll is not in our list of interest.
  75. if (i == interceptions_->num_intercepted_dlls)
  76. return true;
  77. // The dll must be unloaded.
  78. if (dll_info->unload_module)
  79. return false;
  80. // Purify causes this condition to trigger.
  81. if (dlls_[i])
  82. return true;
  83. size_t buffer_bytes = offsetof(DllInterceptionData, thunks) +
  84. dll_info->num_functions * sizeof(ThunkData);
  85. dlls_[i] = reinterpret_cast<DllInterceptionData*>(
  86. new (NT_PAGE, base_address) char[buffer_bytes]);
  87. DCHECK_NT(dlls_[i]);
  88. if (!dlls_[i])
  89. return true;
  90. dlls_[i]->data_bytes = buffer_bytes;
  91. dlls_[i]->num_thunks = 0;
  92. dlls_[i]->base = base_address;
  93. dlls_[i]->used_bytes = offsetof(DllInterceptionData, thunks);
  94. VERIFY(PatchDll(dll_info, dlls_[i]));
  95. ULONG old_protect;
  96. SIZE_T real_size = buffer_bytes;
  97. void* to_protect = dlls_[i];
  98. VERIFY_SUCCESS(GetNtExports()->ProtectVirtualMemory(
  99. NtCurrentProcess, &to_protect, &real_size, PAGE_EXECUTE_READ,
  100. &old_protect));
  101. return true;
  102. }
  103. void InterceptionAgent::OnDllUnload(void* base_address) {
  104. for (int i = 0; i < interceptions_->num_intercepted_dlls; i++) {
  105. if (dlls_[i] && dlls_[i]->base == base_address) {
  106. operator delete(dlls_[i], NT_PAGE);
  107. dlls_[i] = nullptr;
  108. break;
  109. }
  110. }
  111. }
  112. // TODO(rvargas): We have to deal with prebinded dlls. I see two options: change
  113. // the timestamp of the patched dll, or modify the info on the prebinded dll.
  114. // the first approach messes matching of debug symbols, the second one is more
  115. // complicated.
  116. bool InterceptionAgent::PatchDll(const DllPatchInfo* dll_info,
  117. DllInterceptionData* thunks) {
  118. DCHECK_NT(thunks);
  119. DCHECK_NT(dll_info);
  120. const FunctionInfo* function = reinterpret_cast<const FunctionInfo*>(
  121. reinterpret_cast<const char*>(dll_info) + dll_info->offset_to_functions);
  122. for (int i = 0; i < dll_info->num_functions; i++) {
  123. if (!IsWithinRange(dll_info, dll_info->record_bytes, function->function)) {
  124. NOTREACHED_NT();
  125. return false;
  126. }
  127. ResolverThunk* resolver = GetResolver(function->type);
  128. if (!resolver)
  129. return false;
  130. const char* interceptor =
  131. function->function + GetNtExports()->strlen(function->function) + 1;
  132. if (!IsWithinRange(function, function->record_bytes, interceptor) ||
  133. !IsWithinRange(dll_info, dll_info->record_bytes, interceptor)) {
  134. NOTREACHED_NT();
  135. return false;
  136. }
  137. NTSTATUS ret = resolver->Setup(
  138. thunks->base, interceptions_->interceptor_base, function->function,
  139. interceptor, function->interceptor_address, &thunks->thunks[i],
  140. sizeof(ThunkData), nullptr);
  141. if (!NT_SUCCESS(ret)) {
  142. NOTREACHED_NT();
  143. return false;
  144. }
  145. DCHECK_NT(!g_originals[function->id] ||
  146. g_originals[function->id] == &thunks->thunks[i]);
  147. g_originals[function->id] = &thunks->thunks[i];
  148. thunks->num_thunks++;
  149. thunks->used_bytes += sizeof(ThunkData);
  150. function = reinterpret_cast<const FunctionInfo*>(
  151. reinterpret_cast<const char*>(function) + function->record_bytes);
  152. }
  153. return true;
  154. }
  155. // This method is called from within the loader lock
  156. ResolverThunk* InterceptionAgent::GetResolver(InterceptionType type) {
  157. static EatResolverThunk* eat_resolver = nullptr;
  158. if (!eat_resolver)
  159. eat_resolver = new (NT_ALLOC) EatResolverThunk;
  160. if (type == INTERCEPTION_EAT)
  161. return eat_resolver;
  162. NOTREACHED_NT();
  163. return nullptr;
  164. }
  165. } // namespace sandbox